GRC Analyst

About This Role

This role is for a Governance, Risk & Compliance (GRC) Analyst who will project manage the company's compliance program end-to-end. You will be responsible for creating and automating processes, evidence trails, and tracking, working closely with a Principal Security Engineer. The position suits a builder who enjoys creating structure from scratch and is driven to build, with senior guidance available.

Responsibilities

• Own end-to-end project management of the compliance program: support ISO 27001 / SOC 2 audits, manage the policy lifecycle, and handle customer security questionnaires and KYC onboarding
• Manage data protection operations and training, with UK GDPR at the core
• Build and continuously improve how we work: automate manual, currently ad hoc processes (evidence collection, policy tracking, questionnaire responses) rather than running them from scratch each time
• Coordinate business continuity: BCP/DR obligations and ownership of the Major Incident process, including testing and evidencing
• Support our AI governance work: internal AI and engineering AI policies, and help us keep pace with a fast-moving regulatory backdrop (including the EU AI Act), covering data handling, human oversight and vendor assessment
• Coordinate health & safety compliance as we expand into physical premises and data centre operations, helping build a proper H&S management system where none currently exists
• Partner closely with Finance and Engineering/Technology leadership, particularly on KYC, Anti-Bribery & Corruption (ABC) evidence, and technical control documentation
• Help benchmark and align our Code of Conduct and policies with Brookfield's
• Contribute to the wider roadmap as our footprint grows: precious and conflict-minerals due diligence, export controls, and ESG/energy governance

Requirements

• Solid UK GDPR and data protection experience
• Genuine curiosity about how controls actually work: you're not satisfied when "the box is ticked," you want to understand the journey behind it
• Hyper-organised: you can run multiple concurrent workstreams (audits, questionnaires, training, policy updates) without anything slipping
• A builder's mindset: comfortable creating and automating a process from nothing, not just following an existing playbook
• Autonomous and idea-driven: you'll be directed on priorities, not micromanaged on approach
• Mid-level compliance/GRC/information security experience: your background does not need to be from AI infrastructure, data centres, or a related industry
• Confident stakeholder management: you'll work directly with Finance and Engineering/Technology leadership, not just within a compliance team

Nice to have:

• Exposure to ISO 27001 or SOC 2 audit cycles